PT-2026-61153

Name of the Vulnerable Software and Affected Versions fast-uri versions 2.3.1 through 4.1.0 Description The software fails to treat a literal backslash character U+005C as an authority delimiter. Because Node's native WHATWG URL parser normalizes backslashes to forward slashes for specific scheme...

PT-2026-61468

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iommupt component where the driver could omit PAGE SIZE from the pgsize bitmap. While technically permitted, this behavior contradicts the intended design. The fix...

PT-2026-61434

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the ieee80211 prepare and rx handle function. The ieee80211 invoke fast rx function reads RX status via IEEE80211 SKB RXCBskb, which shares the same...

Linux Distros Unpatched Vulnerability : CVE-2026-63828

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - apparmor: mediate the implicit connect of TCP fast open sendmsg sendmsg/sendto with MSGFASTOPEN is a combination of connect2 and write2: it opens the connection...

[SECURITY] Fedora 44 Update: python-tiktoken-0.13.0-2.fc44

tiktoken is a fast BPE tokeniser for use with OpenAI's models...

Security Bulletin: Vulnerability in fast-uri bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging include the fast-uri library, which is affected by a path traversal vulnerability. CVE-2026-6321 Vulnerability Details CVEID:CVE-2026-6321 DESCRIPTION: fast-uri decoded percent-encoded path separators and dot segments before...

MAL-2026-10434 Malicious code in env-fast (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9955128054ee66cd4675be3884e92f9e541ad7e9673496ece60e932c0b83ca5f [email protected] presents as a zero-dependency env loader but on require schedules a 72-hour-delayed activation that POSTs a host fingerprint hostname,...

Malicious code in fast-dotenv (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da3250a4b69ccce49128d2e75ffb9e577746de4fb3afe0e0d242fbe5d094d02d The package presents itself as a.env loader but on load/config spawns a background thread that, after a 72–96 hour activation delay jittered by...

CVE-2026-40452

Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users. This issue affects Apache IoTDB: from 1.3.5 before 1.3.8, from 2.0.5 before 2.0.10. Users are recommended to...

fast-uri: fast-uri: URI authority bypass due to improper delimiter handling

A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by crafting a malicious Uniform Resource Identifier URI that contains percent-encoded authority delimiters. The fast-uri library incorrectly decodes these delimiters during normalization and then re-emits them as raw...

fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies

A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by providing a specially crafted Uniform Resource Locator URL containing percent-encoded path separators and dot segments. Due to incorrect processing, fast-uri would decode these elements before proper normalization...

[SECURITY] Fedora 43 Update: rust-jiter-0.16.0-1.fc43

Fast Iterable JSON parser...

[SECURITY] Fedora 44 Update: python-jiter-0.16.0-1.fc44

Fast iterable JSON parser...

CVE-2026-58253

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when noauthuser was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an...

kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result

A flaw was found in the Linux kernel's Wi-Fi mac80211 subsystem. The ieee80211invokefastrx function uses a static variable for rxresult, which is shared across concurrent calls. This can lead to incorrect processing of Wi-Fi packets, where a packet might be mishandled or its status incorrectly...

Why Unity Remains the Most Popular Engine for Mobile Games

Learn why Unity is still a trusted engine for mobile games, from faster prototyping and Android and iOS support to tools that help studios scale after releases...

PYSEC-2026-1982 Transformers Regular Expression Denial of Service (ReDoS) vulnerability

A Regular Expression Denial of Service ReDoS vulnerability was identified in the huggingface/transformers library, specifically in the file tokenizationnougatfast.py. The vulnerability occurs in the postprocesssingle function, where a regular expression processes specially crafted input. The issu...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.23 security and extras update

Red Hat OpenShift Container Platform release 4.21.23 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a security impact of...

CVE-2026-52830

fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file path. The verifier rejects the exact reserved token telegram, but it does not reject path separators or normalize the path before checkin...

CVE-2026-52830

fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file path. The verifier rejects the exact reserved token telegram, but it does not reject path separators or normalize the path before checkin...